AMENDMENTS TO THE CLAIMS 

The following listing of claims will replace all prior versions, and listings, of claims in 
the application. 

1 . (CURRENTLY AMENDED) A computer-implemented method for 
executing an untrusted program, comprising: 

establishing a limited environment within a general environment, wherein said 
limited environment comprises one or more mock resources, wherein said general 
environment comprises one or more real resources, wherein said limited environment and 
said general environment are both provided by the same operating system, and wherein 
programs executing within said limited environment cannot access the one or more real 
resources in said general environment , wh e r e in said limit e d e nvironm e nt is a sh e ll in a 
UNIX operating system e nvironm e nt ; 

executing at least a portion of an untrusted program within said limited 
environment; and 

examining said limited environment after execution of at least said portion of said 
untrusted program to check for undesirable behavior exhibited by said untrusted program. 

2. (CANCELLED). 

3. (ORIGINAL) The method of claim 1, wherein said limited environment 
comprises a shell in a UNIX operating system environment. 

4. (PREVIOUSLY PRESENTED) The method of claim 1 , wherein 
examining said limited environment comprises: 
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determining whether a particular mock resource of said one or more mock 
resources has been deleted. 

5. (PREVIOUSLY PRESENTED) The method of claim 1, wherein 
examining said limited environment comprises: 

determining whether a particular mock resource of said one or more mock 
resources has been renamed. 

6. (PREVIOUSLY PRESENTED) The method of claim 1 , wherein 
examining said limited environment comprises: 

determining whether a particular mock resource of said one or more mock 
resources has been moved. 

7. (PREVIOUSLY PRESENTED) The method of claim 1 , wherein 
examining said limited environment comprises: 

determining whether a particular mock resource of said one or more mock 
resources has been altered. 

8. (PREVIOUSLY PRESENTED) The method of claim 7, wherein said 
particular mock resource has a parameter associated therewith which changes when said 
particular mock resource is altered, and wherein determining whether said particular 
mock resource has been altered, comprises: 

determining whether said parameter has changed. 
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9. (PREVIOUSLY PRESENTED) The method of claim 8, wherein said 
parameter is a time value indicating when said particular mock resource was last updated. 

1 0. (PREVIOUSLY PRESENTED) The method of claim 1 , wherein 
examining said limited environment comprises: 

determining whether said particular mock resource has been accessed. 

1 1 . (PREVIOUSLY PRESENTED) The method of claim 1 0, wherein said 
particular mock resource contains one or more sets of content, wherein said untrusted 
program executes in a particular portion of memory, and wherein determining whether 
said particular mock resource has been accessed comprises: 

searching said particular portion of said memory for at least one of said one or 
more sets of content. 

12. (ORIGINAL) The method of claim 1, further comprising: 
providing information indicating behavior exhibited by said untrusted program. 

13. (ORIGINAL) The method of claim 12, wherein said information 
comprises indications of undesirable behavior exhibited by said untrusted program. 

14. (ORIGINAL) The method of claim 1, further comprising: 
determining whether said untrusted program has exhibited undesirable behavior; 

and 

in response to a determination that said untrusted program has exhibited 
undesirable behavior, taking corrective action. 
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15. (ORIGINAL) The method of claim 14, wherein taking corrective action 
comprises: 

deleting said untrusted program. 

16. (ORIGINAL) The method of claim 14, wherein taking corrective action 
comprises: 

providing a warning to a user. 

1 7. (CURRENTLY AMENDED) A computer readable medium comprising 
instructions which, when executed by one or more processors, cause the one or more 
processors to execute an untrusted program, said computer readable medium comprising: 

establishing a limited environment within a general environment, wherein said 
limited environment comprises one or more mock resources, wherein said general 
environment comprises one or more real resources, wherein said limited environment and 
said general environment are both provided by the same operating system, and wherein 
programs executing within said limited environment cannot access the one or more real 
resources in said general environment , wh e r e in said limit e d e nvironm e nt is a sh e ll in a 
UNIX op e rating syst e m e nvironm e nt ; 

executing at least a portion of an untrusted program within said limited 
environment; and 

examining said limited environment after execution of at least said portion of said 
untrusted program to check for undesirable behavior exhibited by said untrusted program. 

18. (CANCELLED). 
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19. (ORIGINAL) The computer readable medium of claim 17, wherein said 
limited environment comprises a shell in a UNIX operating system environment. 

20. (PREVIOUSLY PRESENTED) The computer readable medium of claim 
17, wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been deleted. 

2 1 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 
17, wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been renamed. 

22. (PREVIOUSLY PRESENTED) The computer readable medium of claim 
17, wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been moved. 

23 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 
17, wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 
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instructions for causing one or more processors to determine whether a particular 
mock resource of said one or more mock resources has been altered. 

24. (PREVIOUSLY PRESENTED) The computer readable medium of claim 

23, wherein said particular mock resource has a parameter associated therewith which 
changes when said particular mock resource is altered, and wherein said instructions for 
causing one or more processors to determine whether said particular mock resource has 
been altered, comprises: 

instructions for causing one or more processors to determine whether said 
parameter has changed. 

25 . (PREVIOUSLY PRESENTED) The computer readable medium of claim 

24, wherein said parameter is a time value indicating when said particular mock resource 
was last updated. 

26. (PREVIOUSLY PRESENTED) The computer readable medium of claim 
17, wherein said instructions for causing one or more processors to examine said limited 
environment comprises: 

instructions for causing one or more processors to determine whether said 
particular mock resource has been accessed. 

27. (PREVIOUSLY PRESENTED) The computer readable medium of claim 
26, wherein said particular mock resource contains one or more sets of content, wherein 
said untrusted program executes in a particular portion of memory, and wherein said 
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instructions for causing one or more processors to determine whether said particular 
mock resource has been accessed comprises: 

instructions for causing one or more processors to search said particular portion of 
said memory for at least one of said one or more sets of content. 

28. (ORIGINAL) The computer readable medium of claim 17, further 
comprising: 

instructions for causing one or more processors to provide information indicating 
behavior exhibited by said untrusted program. 

29. (ORIGINAL) The computer readable medium of claim 28, wherein said 
information comprises indications of undesirable behavior exhibited by said untrusted 
program. 

30. (ORIGINAL) The computer readable medium of claim 17, further 
comprising: 

instructions for causing one or more processors to determine whether said 
untrusted program has exhibited undesirable behavior; and 

instructions for causing one or more processors to, in response to a determination 
that said untrusted program has exhibited undesirable behavior, take corrective action. 

3 1 . (ORIGINAL) The computer readable medium of claim 30, wherein said 
instructions for causing one or more processors to take corrective action comprises: 

instructions for causing one or more processors to delete said untrusted program. 
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32. (ORIGINAL) The computer readable medium of claim 30, wherein said 
instructions for causing one or more processors to take corrective action comprises: 
instructions for causing one or more processors to provide a warning to a user. 



33-36. (CANCELLED). 
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